The short version
MealMate needs a few things to bring you meals: your mobile number, your name, and where to deliver. We use them to run your meal plan, take payments through bKash, tell your kitchen what to cook and where to bring it, and send you a few useful SMS messages. Your kitchen sees your name, phone number, delivery address and meal choices. bKash handles your payment and we never see your PIN. We don't sell your data, we don't show ads, and the website has no analytics or tracking cookies. You can ask us to see, correct or delete your data at any time by writing to [contact email].
Who we are
MealMate is run by [Company legal name], [registered address], trade licence [trade licence no.] ("MealMate", "we", "us"). We decide how your personal data is used in the MealMate app and on mealmate.bd, so we are responsible for it.
This policy covers the MealMate customer app (Android, and the web version of the app), the website mealmate.bd, and the MealMate Partner app used by kitchen staff and riders. If something here doesn't match what you see in the app, tell us at [contact email].
What we collect
We only collect what we need to run the service. Here is all of it.
Things you give us
- Mobile number. Your account is your Bangladeshi mobile number. We use it to sign you in and to send SMS messages about your meals.
- Name. Optional when you first sign in. If you add it, your kitchen sees it on its delivery list.
- Delivery addresses. Area and block (your "zone"), house and road, floor and flat, a landmark, a note for the rider, and a label (home, hall, mess or office). You can save more than one.
- Map location (optional). If you tap "Use my location" or drag the pin on the map, we save the latitude and longitude of that point with the address, so riders can find your gate. We only read your location when you tap the button. We don't track you in the background.
- Meal plan choices. Which kitchen, which meals (breakfast, lunch, dinner), which days, the plan length, and preferences such as fish or chicken, extra rice and less spicy.
- Skips, pauses and changes. Each meal you skip, each pause (with an optional reason, such as "Going home for Eid"), and each change you undo.
- Problem reports. The meal, what went wrong, an optional note, and an optional photo you take or choose.
- Messages to us. Anything you send to [contact email] or tell us on the phone.
Things created as you use MealMate
- Orders and deliveries. Each meal on your plan becomes an order at the kitchen's nightly cutoff, and we record when it is marked delivered and by whom.
- Payments. For each payment: the amount, status, time, our invoice number, bKash's payment ID and bKash's response to us. We never see or store your bKash PIN or verification code. You enter them on bKash's own page.
- Wallet (meal credit). A permanent record of every credit and every use of credit: skipped and paused meals, kitchen closures, approved problem reports, and credit applied to a plan.
- Changes made by your kitchen on your behalf. If you phone your kitchen and they log a change for you (a skip, pause, item change or new address), we record who logged it and what changed, and send you an SMS receipt.
- SMS we send you. The text of each message, when it was sent and whether it was delivered to the gateway.
- Sign-in and security records. Sign-in codes (stored only in scrambled, hashed form), sign-ins, sign-outs and failed attempts, with the IP address and device/browser description (user agent) involved. We use these to stop abuse and protect your account.
- An audit log. A record of who changed what and when for money and meal changes, so we can settle disputes fairly.
- Server logs. Like most online services, our servers record technical details of requests (time, address requested, result, a request ID).
If a kitchen invited you
A kitchen can invite its existing customers to MealMate. To do that, the kitchen gives us your name and mobile number, and we send you one SMS invite (the kitchen can resend it later). If you never sign up, we keep the invite only to avoid sending you duplicates. Write to [contact email] and we'll delete it.
What we don't collect
We don't collect your NID, date of birth, email address, contacts, photos other than the one you choose for a report, or your location in the background. The customer app has no advertising or analytics code.
How we use your data
- To run your account: sign you in with a one-time code, keep you signed in, and protect your account.
- To run your plan: work out prices and dates, apply credit, lock each day's orders at the cutoff, and give your kitchen exact counts, a prep list and a delivery list.
- To get meals to you: show your kitchen and its riders your name, phone number, address, landmark, rider note and meal choices for the meals they deliver to you.
- To take payments: create and confirm bKash payments, check them server-side, and keep receipts.
- To manage credit: add and remove meal credit when you skip, pause, undo, or when a kitchen closes.
- To handle problems: review reports and photos, decide on a credit or refund, and reply to you.
- To pay kitchens: count delivered meals and pay each kitchen weekly. Kitchens are not paid for meals you got back through a report.
- To message you: sign-in codes, a reminder about 30 minutes before your kitchen's cutoff (you can turn this off in the app), renewal reminders, payment receipts, kitchen closures, receipts for changes your kitchen logged, and replies to your reports.
- To keep MealMate safe and working: rate-limit sign-in attempts, investigate misuse, fix bugs and resolve disputes.
We don't use your data for advertising, we don't sell it, and we don't make automated decisions about you that have legal or similarly serious effects. Problem reports are decided by a person at MealMate.
Our legal basis
Bangladesh's personal data protection law (see "The law we follow" below) puts consent at the centre. We rely on:
- Your consent, which you give when you create an account and agree to this policy, and separately when you allow location access, add a photo, or turn on SMS reminders. You can withdraw consent at any time. Some withdrawals mean we can no longer provide the service (we can't deliver without an address, for example).
- What's needed to provide the service you asked for, such as sharing your address with your kitchen.
- Legal obligations, such as keeping payment and tax records, or responding to a lawful request from a court or authority.
Storage outside Bangladesh
Some of our providers store or process data outside Bangladesh. Cloudflare runs a global network, and our servers may be located in [API hosting country, e.g. Singapore or India]. We choose providers with strong security practices and contracts that limit how they use data. Bangladesh's data protection law has rules on transferring data abroad, and the government may designate categories that must stay in Bangladesh. We don't collect national ID numbers, biometric data or other categories that the law restricts most tightly. We'll update our setup and this policy as the government issues rules.
How long we keep it
We keep data only as long as we need it:
- Account and addresses: while your account is open. Deleted addresses are hidden from you and your kitchen straight away; we keep the record because past orders refer to it.
- Orders, payments, wallet history, audit log and problem reports: 6 years after the transaction, for accounting, tax and dispute purposes. The wallet history can't be edited, only added to, so your credit balance is always provable.
- Problem-report photos:.
- Sign-in codes: expire after 5 minutes and are stored only in hashed form.
- Sign-in sessions: a session can be refreshed for up to 60 days; signing out ends it on that device.
- Sign-in and security records (with IP address):.
- SMS records:. Messages that can't be sent within 12 hours are dropped.
- Kitchen invites for people who never joined:.
When you close your account, we delete or anonymise what we don't need to keep by law. Money records stay for the legal period but are no longer linked to your profile in the app.
How we protect it
- Sign-in by one-time code. Codes last 5 minutes, are stored hashed, and are rate-limited per phone number and per network address. A code locks after 5 wrong tries.
- Short-lived sessions. The app's access pass lasts 15 minutes and is kept only in memory. The longer-lived sign-in token is stored in your phone's secure storage (Android Keystore) in the app, or in your browser's storage on the web. It rotates each time it's used, and if a used token is ever replayed, that sign-in is cancelled.
- Encryption in transit. The app and website talk to our servers over HTTPS.
- Payments checked on our server. We confirm every bKash payment directly with bKash before activating a plan.
- Access control. Kitchens see only their own customers. MealMate staff access is limited to people who need it and is recorded in the audit log.
No system is perfectly secure. If a breach affects your data and is likely to harm you, we'll tell you and report it to the authority as required by law.
Your rights
You can:
- See the personal data we hold about you and get a copy.
- Correct it. You can edit your name and addresses in the app yourself.
- Delete it, by closing your account (see below).
- Withdraw consent, for example turning off location access in your phone's settings or turning off SMS reminders in the app.
- Object or complain about how we use your data.
How to ask: write to [contact email] from anywhere, or message us, and include the mobile number on your account. To protect you, we'll confirm the request by sending a code or calling that number. We aim to reply within 30 days.
Closing your account: the app doesn't have a delete button yet. Write to [contact email] with your mobile number and we'll close your account. Any active plan ends and unused meal credit is lost (credit can't be turned into cash), so use it first.
If you're not happy with our answer, you can complain to the data protection authority set up under Bangladesh's personal data protection law.
Children
MealMate is for people aged 18 and over. Bangladesh's data protection law treats anyone under 18 as a child and requires a parent's or guardian's consent to process their data. If you're under 18, please ask a parent or guardian to set up and pay for the plan on their own account. If we learn that we hold an account for someone under 18 without a guardian's consent, we'll close it.
The law we follow
Bangladesh's Personal Data Protection Ordinance, 2025 (Ordinance No. 61 of 2025) was promulgated on 6 November 2025 and amended in February 2026; it has since been reported as enacted as the Personal Data Protection Act, 2026. Some of its duties start in stages, about 18 months after the Ordinance. We're building MealMate to meet it, but we don't claim to be certified or fully compliant with every rule while regulations are still being issued. We also follow the Consumer Rights Protection Act, 2009 and the Cyber Security Ordinance, 2025, where they apply.
Changes to this policy
If we make a meaningful change, we'll tell you in the app or by SMS before it takes effect, and update the date at the top. If a change needs your fresh consent, we'll ask for it.
Contact
Questions, requests or complaints about your data:
- Email: [contact email]
- Post: [Company legal name], [registered address]
- Data protection contact: [name or role, e.g. Data Protection Officer]
We read every message and aim to reply within 7 days for questions and 30 days for formal requests.
See also our Terms of Service.